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We propose a quantum circuit that creates a pure state corresponding to the quantum superposi- 
tion of all prime numbers less than 2", where n is the number of qubits of the register. This Prime 
state can be built using Grover's algorithm, whose oracle is a quantum implementation of the classi- 
cal Miller-Rabin primality test. The Prime state is highly entangled, and its entanglement measures 
encode number theoretical functions such as the distribution of twin primes or the Chebyshev bias. 
This algorithm can be further combined with the quantum Fourier transform to yield an estimate of 
the prime counting function, more efficiently than any classical algorithm and with an error below 
the bound that allows for the verification of the Riemann hypothesis. Arithmetic properties of prime 
numbers are then, in principle, amenable to experimental verifications on quantum systems. 



Prime numbers are central objects in Mathematics 
and Computer Science. They appeared dramatically in 
Quantum Computation through the Shor's algorithm, 
which converts the classical hard problem of factoriza- 
tion into a polynomial one using quantum interference 
[TJ [2] . In Number Theory, prime numbers are fully char- 
acterized by the prime counting function Tr{x), which is 
the number of primes less or equal to x. This is a step- 
wise function which jumps by one whenever a; is a prime. 
For example 7r(100) = 25 means that there are 25 primes 
below or equal to 100, but 7r(101) = 26 because 101 is a 
prime. The asymptotic behavior of 7r(a;) is given by the 
Gauss law 7r(x) ~ Li(x), where Li(a;) is the logarithmic 
integral function, which for large values of x behaves as 
x/\ogx This statement is known as the Prime Num- 
ber Theorem (PNT). Moreover, the fluctuations of tt{x) 
around Li(a;), will be of order y^loga;, if and only if 
the Riemann hypothesis holds true [3] . Other interesting 
number theoretical functions are iTkix) which gives the 
number of primes p < x, such that p + k is also a prime. 
In particular, the function Tr2{x) counts the number of 
twin primes. According to a famous conjecture due to 
Hardy and Littlewood, Trk{x) ^ 2Ck x/ilogxY for x ^ 1 
[4], where Ck is a /c-dependent constant. 

The aim of this paper is to show that the number theo- 
retical functions 7r(a;), 7rfc(x) and others, can be computed 
in a rather efiicient way using quantum entanglement as 
the main computational tool. In our approach, prime 
numbers are represented by quantum objects which are 
treated as a whole with the computational resources pro- 
vided by spins, photons, ions, or other quantum devices. 
The results we obtain suggest that difficult number theo- 
retical problems could be addressed experimentally, once 
large scale quantum computation becomes available. 

Our starting point is the Prime state made of n-qubits 
that corresponds to the quantum superposition of all 
prime numbers less than 2" (we take n > 1 so that 2" is 



not a prime), 

where each prime number can be expressed in binary 
form p — po2° +pi2^ + . . . +]3„_i2"^^, and is then trans- 
lated into a quantum register on the computational ba- 
sis \p) = |p„_i, . . . ,pi,po)- Note that all the states in 
the sum are orthogonal and that the normalization of 
the state is related to the squared root of the number of 
primes less than 2", namely 7r(2"). 

As an example consider the case of n = 3. Then 

IPs) = -)|(|2) + |3> + |5) + |7)) (2) 

= ^(int) + im) + un> + u;;»- 

where the qubits |0) and |1) are described by the spin 
polarized states f and J, of a spin 1/2 particle. Other 
physical realizations of qubits are of course equivalent. 

Several questions arise regarding the Prime states: 
i) how to prepare them, ii) how to compute the func- 
tions 7r(2"), 7r^;(2"), etc, iii) what are their entanglement 
properties, and iv) are there Hamiltonians whose ground 
states are |P„). These questions will be answered below 
combining standard methods in Quantum Computation 
and Number Theory. 

The answer to question iv) can be readily given. It is 
just sufficient to take as Hamiltonian any primality test 
algorithm that, acting on an integer x, returns a zero 
for prime numbers and any positive eigenvalue A^; for 
composite numbers, that is 

i?primality|a:) =0 if X G P , 

i^primalityla::) ^ K\x) if X 1/ P , (3) 

where P = Poo denotes the set of all prime numbers. 

A more relevant approach consists in turning a classical 
primality test algorithm into a quantum circuit C/pj-imaiity 



2 



that is capable of discriminating prime from composite 
numbers 



E I 

c^compositc 



2"-l 

t/primality ^ |a;)|0 >= |P„)|0 > +A 

(4) 

where the ancilla \Xc) 7^ |0), A is a normalization con- 
stant and the explicit construction of an example of 
t^primaiity wiU be presented later on. It is then possible 
to create the Prime state by performing a measurement 
of the ancilla. The probability to project onto the Prime 
state is given by the probability of measuring on the 
ancilla register, 



Prob(|P„)) = 



7r(2") 1 

n log 2 ' 



(5) 



where we have used the PNT, which shows the efficiency 
of the algorithm, since the probability to obtain the 
Prime state is only polinomially suppressed. 

As a result, we may argue that this circuit brings the 
possibility of measuring 7r(2"). It is enough to repeat the 
preparation and keep the statistics of the output for the 
ancilla measurement. Even though the circuit is efhcient, 
it shares the same complexity as a classical computer try- 
ing to assess the value of 7r(2"). However, conceptually 
the two approaches are quite different. On a classical 
computer every time we create a state, and test for pri- 
mality, we simply get one prime or none. Instead, the 
quantum circuit creates the superposition of all primes. 
This allows for the Prime state to be further used to 
explore its properties. 

The Prime state must carry a large amount of quan- 
tum entanglement. Otherwise, it would be possible to 
simulate it on a classical computer. A good figure of 
merit to quantify the entanglement present in the Prime 
state is the von Neumann entropy for the reduced density 
matrix of a subsystem. To be concrete, we first divide 
the system in the first I qubits and the rest n — I qubits. 
Then the reduced density matrix 



p(0=Tr„_HP„)(P„| 



(6) 



is computed. Finally we calculate the entanglement en- 
tropy 



(7) 



There are two relevant properties of the von Neumann 
entropy of the Prime state. First, we fix the size of the 
register n and we observe that the entropy grows approxi- 
mately as log I. Second, we consider the even bi-partition 
of the system I — n/2, with n even, and explore how the 
entropy S{p(n/2)) varies with n. The entropy can be 
seen to clearly scale almost in the maximal way, that is 
linearly in n. Both results have been obtained from exact 
numerical simulations up to n = 22. 



An interesting question is how single qubits are entan- 
gled with the rest of the qubits in the Prime state. This 
is described by the reduced density matrices 

=Tr„/,|P„)(P„|, z = 0,l...,n-l, (8) 

where the trace excludes the i*^ qubit. For the last qubit, 
i = 0, one finds 



(0) 

Po.o 



1 



(0) _ 7r{N) - 1 (0) 



1 



7r(7V)' 



Pi,i 



t:{N) 



Po, 



7r{N) 



, (9) 



where iV = 2". For a large number of qubits n, the PNT 
implies that the entanglement entropy of the last qubit 
decreases exponentially with n 

5o = -Trp(°) log - 2-"(nlog2)2. (10) 

The reason being that all the primes but 2 are odd, so 
the last qubit is mostly in the state po = 1. A more 
interesting result is obtained for the next to last qubit, 
i ~ 1, whose density matrix is 

(1) _ 7r4,l(iV) (1) _ l-|-7r4,3(^) (1) _ 7^2 \n) 



7r(iV) '^1^1" tt{N) '^"-1" 7r{N) ' 

(11) 

where na^tix) is the number of primes less or equal to x 
that appear in the arithmetic progression am + 6, with 
a and b coprime numbers, and tt2^\x) is the number of 
prime pairs (p, p + 2) less or equal to x with p = 1 mod 4. 
There are also prime pairs with p = 3 mod 4, in num- 
ber 7r2^^(a:), but they do not contribute to Pp^J. The 

sum Tr^\x) + iT^\x) is equal to the twin primes count- 
ing function Tr2{x). Dirichlet proved that the number 
of primes in these arithmetic progressions is infinite [3]. 
Furthermore, the fraction of these primes relative to the 
total number of primes satisfies a version of the PNT, 



lim 

x^oo Li(a;) 



0(a) 



(12) 



where 4'{a) is the Euler totient function, which is the 
number of positive integers x < a which are relative 
prime to a. Using this result and the fact that (/)(4) = 2, 
one finds that the entanglement entropy of the qubit 
i = 1 behaves asymptotically as 



Si = -Trp(i) log p'^' - log 2, n > 1. 



(13) 



So this qubit is maximally entangled with the rest. The 
same property holds for the remaining qubits. The re- 
duced density matrices p''^ also provide the expectation 
values of local operators in the Prime state. In particular 
for the Pauli matrices erf one has 



(0=Tr(p«an 



x,y,z, i^O,. 



1. (14) 



For example the magnetization of the qubit i = I reads 
7r44(iV)-7r4,3(Af)-l 



7r{N) 



(15) 
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The numerator is essentially the Chebyshev bias [5] 

A(a:;) = 7r4^3(a;) - 7r4_i(2;), (16) 

which counts the unbalance of the remainder upon di- 
viding a prime by 4. For low values of x, the remainder 
3 appears more often than the remainder 1, but Hardy 
and Littlewood showed that the relative size of 7r4.3(a;) 
and 7r4^i(x) vary infinitely often so that A(a:) can be ei- 
ther positive or negative [5]. This result, known as the 
prime quadratic effect, could be observed experimentally 
by measuring (cr^). Similarly, the twin prime functions 
TTj ' (N) are the expectation values of one and two sites 
spin flips operators, 



2 4\n) 

tt{N) ' 



'1"2 



y y\ 47r2 



(3) 



(N) 



7r{N) 



(17) 



In analogy with eq. ( |16[ ) we can define the twin prime bias 
^2(2;) = 7:^\x) — TT^{x), which seems also to oscillate. 



A different way to prepare the Prime state corresponds 
to use a primality module as an oracle in Grover's algo- 
rithm [7]. We are searching for M — 7r(2") items (the 
primes below 2") within a set of iV = 2" objects (the 
integers between and 2" — 1). Using the Grover's algo- 
rithm, on a quantum computer, this search can be per- 
formed in N /M) steps with a high probability, which 
represents a significant computational gain j2j. 

As oracle for the Grover's algorithm we use the unitary 
transformation 



Uf\x) ^ (-l)/(-) \x) 



(18) 



where f{x) = 1 if a; G P„ and f{x) = if a; ^ P„. One 
next introduces the unitary U.^ = 2|?/')(^/'| — 1, where 
= N~^/'^ Y^^Zq I^) is the state obtained applying n 
Hadamard transforms to the initial state jO)**". Grover's 
transformation, defined as G = U^Uf, is apphed itera- 
tively to the state jV') until it gets closed to the target 
state |P„). The optimal value of iterations, R(n), is 
estimated by 



Rin) 



arccos 



(2-"/2vV(2^ 



2 arcsin (2.-^/^ ^7r(2")^ 



(19) 



where [x] denotes the integer part of x. If M < N/2, as 
it occurs in our problem, there is an upper bound 



R{n) < 




< i?max('^) 



^ a/" log 2 



(20) 



which follows from the PNT for n ^ 1. Hence the 
Grover's algorithm requires 0{y/n) calls to the oracle. 



25 10 35 



FIG. 1: Left: Number of Grover's steps needed to create the 
Prime state |P„) in the range n = 2, ... ,45 (i?(n): continu- 
ous line and i?max(w): dashed line). Right: Accuracy of the 
state measured by Pain). 



which represents a computational gain compared to a 
classical algorithm (see Fig. [T]). Note that one needs 
about 3 Grover's iterations to construct an approxima- 
tion to the Prime state up to 2"*^ ^ 3.5 x 10^"^!! To assess 
the goodness of the approximation we plot in Fig[l] the 
overlap between the Prime state with the Grover state 
after R{n) iterations. Pain) = |(P„|G^(") IV-)!^- The 
overlap has some jumps with n but it approaches 1 rather 
fast as n increases. 

The above Grover construction relies on the fact that 
some classical primality tests can be turned into a quan- 
tum oracle. This is the case of the Miller-Rabin primality 
test which we will write down below as a quantum circuit. 
The remarkable AKS primality test ([B], which is uncon- 
ditional, deterministic and efficient) could also be turned 
into an oracle. Nevertheless, the Miller-Rabin test has a 
simpler structure which makes easier its conversion into 
a quantum primality oracle. 

Let us first summarize the Miller-Rabin primality test 
[S]. The goal is to declare a number x either prime or 
composite. First, it is necessary to find the integers s 
and d (odd) such that an odd number x is decomposed 
as a; — 1 = 2*d. We then choose a number a, in the range 
1 < a < a;, that is called witness and check 



1'^ ^ 1 (mod x) 



(21) 



^ — 1 (mod a:) < r < s — 1. 



If all these tests are verified, a: is composite with cer- 
tainty. However if the test fails, x can be either prime 
or composite. In the latter case the number a is called 
a strong liar to x. In order to circumvent strong liars, 
it is necessary to rerun the test with different witnesses. 
As more witnesses are tested, the probability to be de- 
ceived by strong liars vanishes. Assuming the General- 
ized Riemann Hypothesis (GRH), the Miller-Rabin test 
is deterministic using less than log^ x witnesses. For 
instance, all numbers below a; < 3 10^^ can be cor- 
rectly classified as prime or composite using as witnesses 
a = 2, 3, 5, 7, 11, 13, 17. We can also implement the prob- 
abilistic version of the Miller-Rabin test which does not 
assume the GRH and that using k witnesses declares a 
composite to be prime with an error less than 2"^*^ [H]. 



4 



| a 



lsx<2'? |i> 



Modular 

Exponenciation 

qubits 



FIG. 2: Structure of the Quantum Primality Oracle based on 
the Miller-Rabin primality test. A series of unitary modules 
implement a quantum version of the modular exponentiation 
tests required by the classical test. The total number of tests 
m is smaller than n^. 



FIG. 3: Detail of the condition that guarantees that only 
those witnesses less than x are tested. 



Hence choosing k to be equal to n the error will be neg- 
Ugable for our purposes. 

The quantum primality oracle based on the Miller- 
Rabin test follows closely the steps of the classical test. 
Basically, a series of unitary modules implement a quan- 
tum version of each of the classical modular exponen- 
tiation tests that form the Miller- Rabin test, as shown 
in Fig. [2j In order to simplify the algorithm, we shall 
consider the construction of the odd superposition in the 
Prime state, that is we leave out the element |2). This 
is a trivial element that could be restored with a sim- 
ple initial controlled gate. We thus start by preparing 
the superposition of all odd numbers less than 2", us- 
ing n — 1 Hadamard operations on the first n — 1 qubits, 
while leaving the last qubit set to |a;o) = and adding 
a set of target ancillae that will be used to implement the 
modular exponentiation tests 



IV-o) 



1 



2(n-l)/2 



E 

,...,2:1=0,1 



.,xi,l)|0). (22) 



For each value of \x) we need to find two states \d) and 
\s) such that \x—l) — \d)\s). This can be done using the 
fact that \s) is related to the number of trailing zeros in 
the register when subtracting 1, while \d) is related to the 
initial set of the qubits. Let us illustrate this fact in the 
case where the register reads |25) — |1, 1,0, 0,1), where 
we have \d) = |3) = |11) (from the initial |1, 1) piece of 
the register) and s = 3 (that is |000) from the trailing 
|0,0, 1) minus 1, see Fig. |3|. This example shows that a 
series of gates controlled by several qubits is enough to 
perform the modular exponentiation as a unitary opera- 
tion 

Ua,r^\x)\Q) |a;>|a^'^'^(moda;)), < r < s - 1. 

X X 

(23) 



Modular Test 

Exponenciation s=1 

qubits |d*=|x,XjX, 



FIG. 4: Implementation of a; — 1 = 62" on a quantum circuit. 
The value of s is inferred by the trailing zeros in the register, 
while d is read from the leading qubits. 



Nevertheless there is a subtle detail to be considered. 
The Miller- Rabin test requires the witness a to be smaller 
than X. Fortunately, this condition also guarantees that 
the above operation is unitary [5] . Therefore the action of 
each unitary modular exponentiation needs to check that 
X is large enough for each witness. This again is simply 
taken care of by a controlled gate to the most relevant 
qubits in x (see Fig. [3]). For instance, a gate control to 
the most relevant qubit in x, that is |a;„) will act when 
the qubit is |1), that is when x > 2"^^ and all witnesses 
less than 2"^^ can be used. Let us here recall that the 
values of the witnesses in the Miller-Rabin algorithm are 
far smaller than the values of x they can test. 

The next step in the algorithm is to collect the result 
of the tests. The guiding principle is to assume x is com- 
posite till proven prime. A set of ancillary carriers will 
be initialized in a state corresponding to composite un- 
less they are changed by the result of a test, which will 
correspond to prime. Let us recall that in order for an 
integer x to be declared a probable prime we just need to 
find that a'' = 1 or = — 1 for some r € [0, s — 1)] (see 
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Eq.(21|). This can be achieved quantum mechanically 



by adding an ancillary carrier for each test based on the 
witness a and the value r, that we call testa, r such that 
it is initially set to Itest^^r) = and then changed to 
|0) if the testa, r fails detecting a probable prime, 



Uu 



a^''*(modx))|0) = |a2'''^(moda;))|testa,r) • (24) 



After the action of all tests, all ancillae carriers will be 1 1) 
only for composite numbers, and will have at least one 
|0) for prime numbers. This suggests to include a single 
extra global ancilla that summarizes all tests, initialized 
to We then perform a TofFoli gate C/giobai controlled 
to all test ancillae 



lobal 



[||testa,.)|l> 



J||testa,.)|global) (25) 



If X is prime, the global ancilla will flip to |0), and if x is 
composite it will remain in the state |1). This is precisely 
what we need to implement the Grover condition in the 
usual way using a single state. 

To finish the algorithm, after the Grover sign flip on 
primes is achieved, we need to invert all the unitary op- 
erations so as to reset all ancillae to their initial product 
state. 

The computational complexity of the Miller-Rabin 
quantum oracle is only polynomial. We can bound the 
number of basic operations in the following way. There 
are at most witnesses to be tried. Each witness needs 
at most n exponential tests. Each test is of order op- 
erations. Altogether, the oracle complexity scales as n^. 
This counting assumes that some test carriers and con- 
trol operations to guarantee that a < x are done using 
single Toffoli-like gates. Note that, as a matter of fact, 
the number of witnesses needed in practice is lower than 
the bound proven using the Generalized Riemann hy- 
pothesis. Therefore, the algorithm will work in a faster 
way in practice. 

The full power of the Grover algorithm becomes man- 
ifest when it is combined with the efficient quantum 
Fourier transform. The Quantum Counting algorithm 
[TU] is based on the idea that the Grover module is fol- 
lowed by an appropriate controlled phase gate in such a 
way that, after completion of the series of calls to the ora- 
cle, a quantum Fourier transform is performed to read the 
number of solutions to the oracle. In our case, the Quan- 
tum Counting algorithm that makes use of our Grover 
primality oracle allows to compute the number of solu- 
tions M — 7r(2") = tt{x) with a bounded error. To be 
precise, it will produce an estimate AI to the actual num- 
ber of solutions M to the oracle such that 



M- M 



< 



27r 



Ml/2 ^ ^ 



(26) 



where c is a constant, using only cN^^^ = cx^^^ calls to 
the oracle, that is time steps. Given that 7r(x) x/logx, 



our quantum algorithm can verify the prime counting 
function with an accuracy 



|7t(2;) — 7r(x)| < 



27r x^/^ 
c logi/^x 



(27) 



and 0{n = log(a;)) space allocation. These results provide 
an exponential gain with respect to knwon classical al- 
gorithms, when considering the need for both time and 
memory resources. The classical computation of tt{x) of 
use was proposed by Lagarias, Miller, and Odlyzko [TT] . 
who refined the Meissel-Lehmer method. The number of 
bit operations is of order a;^/^ and the storage needed is of 
order x^^^, where both scalings have log corrections. La- 
garias and Odlyzko have also proposed two analytic Tr(x)- 
algorithms based on the Riemann zeta function, whose 
order in time and space are x^^^~^'^ (e > 0) and x*^ in one 
case, and x^/^"'''^ and x^^'^'^'^ in the other case [H]. The 
latter algorithms has been implemented numerically to 
compute 7r(102'*) unconditionally [T^]. Classically, it is 
possible to find other algorithms that trade space with 
time, yet the product of time and memory is always big- 
ger than order x^^"^. The estimation of tt{x), given by 
eq. ( 27 1 , is smaller than the error predicted under the Rie- 
mann hypothesis (RH), i.e. |7r(a;) — Li(a::)| < 0{y/xlogx), 
thus the RH could be tested experimentally on a quan- 
tum computer with numbers far beyond the reach on any 
classical computer. 
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